What is the CVSS score of CVE-2025-64838?

CVE-2025-64838 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Adobe Experience Manager CVE-2025-64838

EUVD-2025-210866 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-09-08 psirt@adobe.com

GHSA-gh3f-m85p-mg4x

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L confirmed by required author account; S:C reflects cross-context script execution in victim's browser; no availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 09, 2026 - 01:25 vuln.today

CVE Published

Sep 08, 2026 - 20:17 nvd

MEDIUM 5.4

DescriptionCVE.org

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields within the authoring environment. When any higher-privileged user subsequently browses the affected page, the script executes in their browser within a changed scope, potentially enabling session theft or unauthorized actions. Adobe has issued advisory APSB26-98 covering AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0; no public exploit or CISA KEV listing has been identified.

Technical ContextAI

Adobe Experience Manager is a Java-based enterprise CMS platform used for large-scale digital content delivery, available both as an on-premises product (AEM 6.5 and 6.5 LTS) and as a managed cloud service (AEM as a Cloud Service). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), where user-supplied data entered into one or more form fields is persisted without adequate output encoding and later rendered in page HTML. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) specifies scope change (S:C), indicating that the injected payload executes in a security context beyond the vulnerable AEM component itself - typically an administrator's browser session. This is consistent with classic stored XSS in a CMS authoring interface where low-privileged authors can create content consumed by privileged editors or administrators. Affected versions include AEM 6.5 ≤6.5.24, AEM 6.5 LTS ≤SP2, and AEM as a Cloud Service ≤2026.7.0, as confirmed by EUVD-2025-210866.

RemediationAI

Apply the fixes detailed in Adobe security advisory APSB26-98 (https://helpx.adobe.com/security/products/experience-manager/apsb26-98.html). For AEM 6.5 on-premises, upgrade to the version specified in APSB26-98 beyond the 6.5.24 threshold; for AEM 6.5 LTS, apply the service pack superseding SP2 as indicated in the advisory. AEM as a Cloud Service customers on managed infrastructure should confirm their environment has been updated past the 2026.7.0 baseline through the Adobe Cloud Manager console. As a compensating control prior to patching, restrict content-authoring access to the minimum required set of trusted users, and enforce a Content Security Policy (CSP) header on publish-tier responses to restrict unauthorized script execution origins - note that CSP tuning in AEM may impact legitimate clientlib-based JavaScript and should be validated in a staging environment before production rollout.